sso认证中心增加校验token，并使用redis缓存token

zheng-upms/zheng-upms-server/pom.xml

@@ -80,8 +80,8 @@
             <plugin>
                 <groupId>org.eclipse.jetty</groupId>
                 <artifactId>jetty-maven-plugin</artifactId>
-                <!--<version>9.0.0.v20130308</version>-->
-                <version>9.2.7.v20150116</version>
+                <version>9.0.0.v20130308</version>
+                <!--<version>9.2.7.v20150116</version>-->
                 <configuration>
                     <scanIntervalSeconds>3</scanIntervalSeconds>
                     <webApp>

zheng-upms/zheng-upms-server/src/main/java/com/zheng/upms/admin/controller/SSOController.java

@@ -1,6 +1,6 @@
 package com.zheng.upms.admin.controller;
 
-import org.apache.commons.lang.ObjectUtils;
+import com.zheng.common.util.RedisUtil;
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -12,6 +12,8 @@ import org.springframework.web.bind.annotation.ResponseBody;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
 import java.net.URLEncoder;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.UUID;
 
 /**
@@ -23,10 +25,21 @@ import java.util.UUID;
 public class SSOController {
 
 	private static Logger _log = LoggerFactory.getLogger(SSOController.class);
+	private static List<String> apps = new ArrayList<>();
+	{
+		apps.add("zheng-cms-job");
+		apps.add("zheng-cms-web");
+		apps.add("zheng-cms-admin");
+		apps.add("zheng-upms-app1");
+		apps.add("zheng-upms-app2");
+		apps.add("zheng-upms-server");
+	}
 
 	/**
 	 * 认证中心首页
+	 * @param request
 	 * @return
+	 * @throws Exception
 	 */
 	@RequestMapping("")
 	public String index(HttpServletRequest request) throws Exception {
@@ -34,17 +47,19 @@ public class SSOController {
 
 		String system_name = request.getParameter("system_name");
 		String backurl = request.getParameter("backurl");
-		if (StringUtils.isEmpty(system_name) || !system_name.equals("zheng-cms-admin")) {
+
+		// 判断请求认证系统是否注册 TODO
+		if (StringUtils.isEmpty(system_name) || !apps.contains(system_name)) {
 			_log.info("未注册的系统：{}", system_name);
 			return "/404";
 		}
 		// 判断是否存在全局会话
 		// 未登录
-		if (null == session.getAttribute("isLogin")) {
+		if (StringUtils.isEmpty(RedisUtil.get(session.getId() + "_token"))) {
 			return "redirect:/sso/login?backurl=" + URLEncoder.encode(backurl, "utf-8");
 		}
 		// 已登录
-		String token = ObjectUtils.toString(session.getAttribute(session.getId()));
+		String token = RedisUtil.get(session.getId() + "_token");
 		String redirectUrl = backurl;
 		if (backurl.contains("?")) {
 			redirectUrl += "&token=" + token;
@@ -66,10 +81,13 @@ public class SSOController {
 
 	/**
 	 * 登录页post
+	 * @param request
 	 * @return
 	 */
 	@RequestMapping(value = "/login", method = RequestMethod.POST)
 	public String login(HttpServletRequest request) {
+		HttpSession session = request.getSession();
+
 		String backurl = request.getParameter("backurl");
 		String username = request.getParameter("username");
 		String password = request.getParameter("password");
@@ -82,11 +100,10 @@ public class SSOController {
 			return "/404";
 		}
 		// 默认验证帐号密码正确，创建token
-		HttpSession session = request.getSession();
-		_log.info("子系统sessionId：{}", session.getId());
-		String token = UUID.randomUUID().toString().replace("-", "");
-		session.setAttribute("isLogin", true);
-		session.setAttribute(session.getId(), token);
+		String token = UUID.randomUUID().toString();
+		RedisUtil.set(session.getId() + "_token", token, 2 * 60 * 60);
+		RedisUtil.set(token, token, 2 * 60 * 60);
+		// 回调子系统
 		String redirectUrl = backurl;
 		if (backurl.contains("?")) {
 			redirectUrl += "&token=" + token;
@@ -97,4 +114,38 @@ public class SSOController {
 		return "redirect:" + redirectUrl;
 	}
 
+	/**
+	 * 校验token
+	 * @param request
+	 * @return
+	 */
+	@RequestMapping(value = "/token", method = RequestMethod.POST)
+	@ResponseBody
+	public String token(HttpServletRequest request) {
+		String tokenParam = request.getParameter("token");
+		String token = RedisUtil.get(tokenParam);
+		if (StringUtils.isEmpty(tokenParam) || !tokenParam.equals(token)) {
+			return "failed";
+		}
+		return "success";
+	}
+
+	/**
+	 * 退出登录
+	 * @param request
+	 * @return
+	 */
+	@RequestMapping(value = "/logout", method = RequestMethod.GET)
+	public String logout(HttpServletRequest request) {
+		HttpSession session = request.getSession();
+
+		// 清除全局会话
+		String token = RedisUtil.get(session.getId() + "_token");
+		RedisUtil.remove(session.getId() + "_token");
+		RedisUtil.remove(token);
+		// 通知该token的子系统退出登录
+		// TODO
+		return "/sso/login";
+	}
+
 }

zheng-upms/zheng-upms-server/src/main/resources/log4j.properties

@@ -18,6 +18,6 @@ log4j.logger.druid.sql.Statement=warn,stdout
 log4j.logger.druid.sql.ResultSet=warn,stdout
 
 # MyBatis logging configuration
-log4j.logger.com.zheng.qa.dao.mapper=debug
-#log4j.logger.com.zheng.qa.dao.mapper.UserMapper=debug
-#log4j.logger.com.zheng.qa.dao.mapper.UserMapper.selectUser=debug
+log4j.logger.com.zheng.upms.dao.mapper=debug
+#log4j.logger.com.zheng.upms.dao.mapper.UserMapper=debug
+#log4j.logger.com.zheng.upms.dao.mapper.UserMapper.selectUser=debug